In the near future digital cash will come into wider use and it is expected that people will use the Internet to make digital cash payments for their purchases. Electronic transactions should be convenient, reliable, accurate, and resistant to fraud. Certain electronic transactions also should protect the privacy of payees. For example, a customer purchasing a service from a vendor over a network should be able to pay for the service in an electronic transaction without revealing their identity.
Some schemes using on-line banking may prevent double spending by checking each coin against reuse during the time of payment on-line rather than detecting double spending afterwards. However, on-line banking is obviously not suitable for micro-payments of the average consumer. Banks are too few compared with the vast number of small cash transactions that would need to be processed if average consumer transactions were to be supported. Processing on-line requests for such transactions will result in banks becoming serious bottlenecks to handle these transactions.
Blind signature systems that use off-line digital cash techniques have high system complexity. In some other conventional techniques, a coin has a data size that is too big to be economically used since the coin contains a large number of challenge terms to detect cheating. In addition, some techniques also require using complex challenge-response interactions between the payer and payee for each coin spent. Again, such complex schemes are also not suitable for micro payments.
Some systems have implemented digital coins that are both secure (in the bank's interest) and afford a heightened assurance of consumer privacy by providing some anonymity to users with respect to both merchants and banks. Informally, a digital cash scheme is referred to as unconditionally blind or anonymous if the bank that issues a coin is unable to determine, either at the time of withdrawal or later upon examining circulating or deposited coins, which coin was withdrawn by which user. In a unconditionally blind scheme, the user can withdraw money from the bank, spend it at a merchant, and be confident that when the merchant deposits the money at the bank, the bank will not be able to recognize the money as the same cash given to the user.
However, researchers have observed that unconditional anonymity in payment systems might be exploited to facilitate crimes like blackmail. In addition, there is a fear that such schemes of unconditional anonymity may be abused to perfect crimes of money laundering and kidnapping because this system can make the flow of cash completely untraceable. This observation has spurred research into the idea of making anonymity in payment systems conditional, and, in particular, revocable by a third party. This notion is referred to as a trustee-based coin tracing.
One trustee-based tracing scheme is based on a blind Schnorr-like signature scheme that involves use of interactive proofs between trustees and the bank. Another trustee-based tracing scheme is based on blind RSA signatures, but makes use of a cut-and-choose protocol that results in a scheme that is flexible. Although this scheme may be somewhat flexible, it has rather large coin sizes and computational requirements.
According to another scheme that makes use of a blind signature, a user requests a pseudonym and registration information from a trustee. The user presents this registration information to the bank, and incorporates the information into the coins that are withdrawn.
Another scheme makes use of blind DSS signatures. In this scheme, signing and anonymity revocation may be conducted by differing quorums of trustees. However, the scheme is implemented on-line only and is rather computationally intensive for most operations.
A slightly different approach to trustee-based tracing is a system based on blind Schnorr signatures in which a user transfers finds from a non-anonymous to an anonymous account where a trustee is capable of linking the two accounts. The chief disadvantage of this approach is that once the two accounts are linked, anonymity is eliminated.
Another approach is based on blind Schnorr signatures in which the trustee is off-line. This system is complex and involves well over a dozen modular exponentiations by the user at each coin withdrawal. Later developments have reduced the computational required in the withdrawal protocol, as well as the database search requirements in owner tracing. However, the withdrawal protocol still requires over a dozen modular exponentiations on the part of the user.
The use of blinding alone that protects the anonymity of the customer is not sufficient to safeguard against certain types of fraud. For example, a customer can submit a blinded nonce (a nonce is a piece of data that, for practical purposes, is used only once, for example, a random number) to the certification authority along with $20, receive the blinded certificate, un-blind it, and then submit the un-blinded certificate as being worth $100. This is possible because the certification authority never really sees the actual certificate it is signing because of the blinding factor. Thus, although blinding alone protects privacy, it does not by itself provide adequate reliability against fraud and misuse.
Another problem of blind signature it is a homomorphism, i.e., Sign(kx)=Sign(k)Sign(x). It is possible to create pairs r, Sign(r) for a random message r. More precisely, anyone can choose Sign(r) at random and then compute r as the function Sign−1 which is known publicly. The basic idea is as follows. Customer C chooses a message x which is going to be the coin. C also generates a pair, k and Sign(k), for a random number k. C sends the product kx to a bank B which computes Sign(kx). B then sends Sign(kx) to C, using, for instance, a public encryption scheme provided by C (using some session key exchanged between C and B using a Diffie-Hellman session) or some other form of communication (e.g., delivery on a diskette transported by an armored carrier). C may then compute Sign(x) by dividing Sign(kx) by Sign(k). The pair (x, Sign(x)) is now redeemable by B at a value usually determined by the signature being used, and B cannot recognize C when some payee P presents (x, Sign(x)) (since the knowledge of kx does not allow practical recognition of x nor of Sign(x)).
A problem with this approach is that a signature scheme with such properties is not secure. This scheme provides that (1) it is easy to forge signatures on random messages, and (2) after seeing the signatures on two messages x1 and x2, it is easy to compute the signature on the message x=x1x2. In order to overcome this problem, valid messages are required to have a special “structure” (e.g., the message x must be encoded using the PKCS#1 standard for digital signature). The hope is that messages with this structure are sparse and hard to forge even given properties (1) and (2) (since messages with that structure will not appear with a significant probability). However, this is simply a hope and is not a proven mathematical property of the signature scheme or of the encoding. The drawback is that it may be possible to discover an algorithm to forge messages even when we restrict them to this structured sparse set.
Schemes that use virtual accounts have several problems. For example, some virtual accounts do not provide adequate privacy of the user, while others are complex requiring a blind signature to protect the privacy of the user. Still other embodiments have the bank storing encrypted pseudonym corresponding to the user identification which makes linking identity to the pseudonym easy either by cooperation or leakage of the secret key of the issuer. Accordingly, the privacy of all users can be catastrophically destroyed. In addition, there is a problem of proving the ownership of the user identity between the user and the bank.